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APOLLO EXPERIENCE REPORT 

GUIDANCE AND CONTROL SYSTEMS: 

LUNAR MODULE STABILIZATION AND CONTROL SYSTEM 

By D. Harold Shelton 
Lyndon B. Johnson Space Center 

SUMMARY 


The lunar module stabilization and control system , which is part of the lunar 
module guidance , navigation , and control system , is designed to control vehicle 
attitude and translation about or along all axes during a lunar module mission . 
Vehicle attitude and small translations are controlled by selectively firing the 
16 reaction control system jets mounted on the ascent stage. The design concepts 
used were representative of the state of the art , and six different assemblies con- 
stituted the subsystem: (1) attitude and translation control assembly, (2) descent- 

engine control assembly , (3) rate gyro assembly , (4) attitude controller assembly , 
(5) thrust and translation controller assembly, and (6) gimbal drive actuator. 

Subsystem procurement was at the assembly , or black-box , level , and 
the lunar module contractor was responsible for black-box integration. Design- 
feasibility and design-verification tests were performed at the assembly level 
during developmental phases , using early production equipment . 

Subsystem-level testing was accomplished in vehicles and in the lunar module 
contractor Full Mission Engineering Simulator/Flight Control Integration Labora- 
tory. All detailed test objectives were satisfactorily accomplished before the 
Apollo 11 (lunar module 5) mission. 


INTRODUCTION 


The initial concept and configuration of the lunar module (LM) guidance 
and control (G&C) system evolved during the period from 1963 to 1964. The initial 
concept included the Government -furnished primary guidance subsystem for the 
necessary guidance and navigation functions and the contractor-furnished stabiliza- 
tion and control subsystem (SCS) for the vehicle stabilization and control functions. 


Additionally, the SCS was to act as a backup guidance system that would permit 
attainment of a safe lunar orbit if primary guidance were lost . 

By mid-1964, the SCS stabilization and control functions had become fairly 
well defined , the design-control specifications had been completed , and subcon- 
tracts had been awarded for most assemblies. During the fall and winter of 1964, 
NASA and two participating contractors reviewed the LM and G&C requirements 
and the hardware capabilities of the primary guidance subsystem and the SCS . 

This review resulted in implementation of the integrated G&C concept . Additionally , 
the backup or abort guidance requirements were further established as being more 
complex than originally envisioned (ref. 1) . 

The LM G&C subsystem provides two paths or subsystems for vehicle G&C. 

The primary guidance, navigation, and control subsystem (PGNCS) provides the 
necessary G&C capability for mission completion. The abort guidance subsystem 
(AGS) provides the necessary G&C capability for mission abort if the PGNCS fails 
but does not provide the capability to complete a lunar landing mission . The SCS 
forms an integral part of both the primary and abort subsystems . As part of the 
primary system, the SCS includes the drivers for reaction control subsystem (RCS) 
jet operation; the electronic interface for descent-engine thrust and gimbal control; 
and the hand controllers for manual attitude , descent-thrust , and translational 
input commands. In the AGS, the SCS includes jet-select logic, signal summing, 
gain control, and the same hand controllers used for manual commands in the PGNCS. 
The attitude reference or steering errors are provided to the 3CS by the AGS . 

As an aid to the reader , where necessary the original units of measure have 
been converted to the equivalent value in the Systeme International d'Unites (SI) . 

The SI units are written first , and the original units are written parenthetically 
thereafter. 


FUNCTIONAL DESCRIPTION 


The major features of both the PGNCS and AGS modes are summarized in 
the following brief functional description of the SCS . The LM SCS is part of the 
LM guidance , navigation , and control system and is designed to control vehicle 
attitude and translation about or along all axes during an LM mission . Vehicle 
attitude and small translations are controlled by firing one or more of the 16 RCS 
jets mounted on the ascent stage. Major translations are accomplished by means 
of the ascent or descent propulsion engine. Rotation around the LM X-axis, Y-axis, 
and Z-axis is termed yaw , pitch , and roll , respectively . Movement along an axis 
is termed translation . The LM axes form a right-handed orthogonal triad . 
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The LM guidance , navigation , and control system contains two independent 
guidance sections. The PGNCS is designed to control the LM during all mission 
phases . The AGS is designed to guide the LM to the command and service module 
if the PGNCS fails. A simplified block diagram of the SCS is shown in figure 1. 
The SCS flight hardware is shown in figure 2. 
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Figure 1 .- Block diagram of LM SCS . 


Primary Mode 

When operating in the PGNCS mode, the SCS performs the following functions. 

1. Converts RCS jet commands issued by the LM guidance computer (LGC) 
to the electrical power required to operate the RCS-jet solenoid valves for attitude 
and translation control 

2 . Accepts discrete (on-off) descent -engine gimbal commands from the 
LGC (Upon receipt of an "on" command, the descent engine is gimbaled about its 
axes at a constant angular rate until the command is removed.) 

3 . Accepts LGC automatic and manual engine on-off commands and routes 
them to the propulsion system to start or stop the descent or ascent engine 


3 










Descent- engine 
control assembly 



controller 

assembly 



Figure 2.- Lunar module SCS hardware. 


4 . Accepts LGC automatic thrust 
commands and thrust and translation 
controller assembly (TTCA) manual 
thrust commands to control the thrust 

of the descent engine 

5 . Provides manual attitude 
and translational commands to the LGC 

The LM digital autopilot (DAP) 
has interfaces with 16 RCS solenoid 
driver preamplifiers in the attitude and 
translation control assembly (ATCA) 
and with the pitch- and roll-trim gimbal 
servomotor drives in the descent-engine 
control assembly (DECA) . During the 
descent -engine burn , the DAP tries 
to control the spacecraft attitude with 
the trim gimbal servomotor drive to 
save RCS propellants; however, if the 
rather slow trim gimbal servomotor 
drive does not keep the attitude error 
within specified bounds , the RCS jets 
are used until the error is brought within 
the trim gimbal servomotor 


the attitude dead band , and control is then returned to 
drive . 


The DAP works in conjunction either with a PGNCS guidance loop to provide 
an automatic G&C system or with the TTCA and the attitude controller assembly 
(ACA) for manual G&C. In the latter mode of operation, the DAP provides the crew- 
man with an integrated stabilization and control system for performing translational 
maneuvers and for maintaining rate comm and/ attitude hold. 

The DAP monitors the eight RCS thruster-off signals and chooses the best 
set of jets to use under the combined conditions of rotational commands, transla- 
tional commands, and disabled jets. Propellant economy, minimization of the number 
of RCS jet firings, and operation with detected and undetected jet failures are of 
primary concern . The LGC will issue automatic engine on , engine off , descent- 
engine thrust magnitude , and descent-engine gimbal position commands , all auto- 
matically under program control . 

The rate-command/ attitude-hold mode is the normal means of astronaut control 
of the spacecraft. The maximum maneuver rate about any axis of the spacecraft 
is 20 deg/sec. The ACA acts as an analog device during rate command by produc- 
ing a voltage proportional to stick deflection. The voltage, which represents 
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commanded rate , is converted to a binary number (quantized at approximately 

0.625 deg/sec/bit) and presented to the DAP. When the stick is out of detent, 
the DAP tries to match the vehicle rate to the rate commanded by the hand controller. 
When the rate error is less than the rate dead band (0.4 deg/ sec during descent, 

1.0 deg/sec during ascent) , the jets are no longer commanded on. However, if 
the rate error exceeds a specified bound (2.0 deg/sec during ascent, 1.4 deg/ sec 
during descent) , four jets are used to torque the spacecraft. When the ACA is 
returned to the detent position, the DAP computes the time of jet firing required 
to zero the rates of the vehicle . When the rate of the vehicle is brought inside 
a dead band about zero rate, the contents of the coupling data unit (CDU) registers 
are transferred to the desired CDU registers , and attitude steering about the newly 
attained position of the vehicle is begun . If the spacecraft has large pitch- and 
roll-rate errors, diagonal jets are used; the jets are thus selected efficiently. 

The crewman uses the minimum -impulse mode to control the spacecraft with 
very small rate maneuvers. Each discrete deflection of the ACA 2.5° or more out 
of detent will cause the DAP to issue commands to the appropriate jets for a minimum 
impulse . In this mode , an astronaut must anticipate on his own and perform rate 
damping and attitude steering. 

Selection of the minimum -impulse mode enables the crewman to perform an 
economical low-rate maneuver to a new orientation of the spacecraft. After comple- 
ting the maneuver , the crewman codes the display and keyboard , and the DAP 
returns to attitude hold and causes the vehicle to limit cycle , with the normal atti- 
tude steering about the new orientation . 


Abort Mode 

When operating in the abort guidance mode , the SCS performs the following 
functions . 

1. Accepts attitude-error signals from the AGS or manual attitude-rate 
commands from the ACA and fires the proper RCS jets to achieve attitude control 
(Rate damping is achieved by summing the error signal or the rate command with 
the rate gyro feedback signals.) 

2 . Accepts manual translational commands from the TTCA and fires RCS 
jets to accelerate the LM in the desired direction 

3. Automatically gimbals the descent engine for trim control 

4. Accepts AGS automatic and manual engine on-off commands and routes 
them to the descent or ascent engine 
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5 . Accepts TTCA manual-throttle commands to control the thrust of the 
descent engine 

The abort system provides the same basic autopilot modes provided by the 
DAP; that is, automatic, rate comm and /attitude hold, and pulse. In these modes, 
the ATCA (rather than the LGC) receives signals from the TTCA, the ACA, and 
the AGS (steering errors or attitude reference) and provides the necessary jet- 
select logic for jet firing. In the pulse mode, a series of minimum-impulse jet 
firings is provided when the ACA is deflected 2.5°. This series of pulses contrasts 
with the single pulse used for this mode in the primary system . 


SUBSYSTEM DESIGN AND DEVELOPMENT 


The discussion of subsystem design and development includes subsystem 
requirements definition, assembly design and development, and subsystem verifi- 
cation tests . 


Subsystem Requirements Definition 

The major elements of the subsystem functional and performance requirements 
were developed from 1963 to 1965. Periodic meetings were held at the NASA Lyndon 
B. Johnson Space Center (JSC) (formerly the Manned Spacecraft Center (MSC)) 
during the requirements definition phase. Interested personnel from MSC, NASA 
Headquarters , and three contractors participated in the meetings , which were 
helpful in bringing different viewpoints into focus regarding the establishment 
of detailed requirements concurrently with hardware design. Before the integrated 
G&C concept was adopted, the more significant results of these meetings were 
recorded in the proceedings of the LM SCS meetings for the period from 1963 to 
early 1964. The implementation of the integrated concept began in September 1964 
and is documented in the LM G&C implementation meeting minutes. 


Assembly Design and Development 

Hardware procurement by the LM contractor was at the black-box or assembly 
level. Individual design-control specifications were prepared for each assembly 
by the LM contractor , and competitive bids were used for vendor selection . The 
task of assembly integration was retained by the contractor . Overall hardware- 
design and development-test requirements are defined in a Type I contract specifi- 
cation . In this specification , broad subsystem functional and interface requirements 
are stated; the scope of the developmental and qualification test programs is estab- 
lished; and applicable publications, specifications, and standards are defined. 
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The requirements in this specification are reflected and interpreted as appropriate in 
the individual-assembly design-control specifications, which are Type II documents. 

The same general pattern was followed in the development of each assembly. 
Developmental tests performed to provide data for use in the design (or in the 
support of the design) are categorized as design-feasibility tests and design- 
verification tests . The feasibility tests were performed to select components and 
parts , to investigate the performance of breadboard or preproduction components 
or subassemblies under various environmental conditions, to select materials, 
and to substantiate safety margins or other analytical assumptions. The verification 
tests were performed to verify the capability of the design to meet the end-use 
performance and environmental requirements. These tasks were performed on 
early production equipment (flight packaged but not of flight quality) under selected 
critical environments and provided the necessary confidence that the equipment 
design would pass the formal qualification tests. 

The formal qualification tests were performed at the assembly level on two 
production units. One of these units was subjected to sequential, singly applied 
environments at design-limit conditions (design-limit test); the other was subjected 
to one operational cycle and one subsequent mission cycle at nominal mission condi- 
tions (endurance test) . The environments and levels were defined in each of the 
design-control specifications as well as in the appropriate certification test require- 
ment (CTR) . It should be noted that the qualification tests were performed at the 
assembly level and not at the subsystem level. 

The LM test article 3 (LTA-3) structural vehicle was used to gather vibra- 
tion data from which vibration requirements were generated for each assembly 
represented by a mass model during vibration tests. The LTA-5 vehicle was used 
to provide further data on descent-engine and RCS vibration environments. Data 
obtained from the LM-1 flight test were used to refine the vibration requirements 
further . The vibration environments used in the assembly qualification tests were 
defined in Apollo Spacecraft Program Office memorandums . 

An acceptance test was performed by the vendor on each production assembly 
to demonstrate that the assembly satisfied all applicable requirements in the design- 
control specification . Initially , the plans for acceptance testing included tests 
under both vibration and thermal -vacuum environments , but these environmental 
tests were eliminated for most assemblies as an economy measure . However , testing 
under these environments was reinstituted in late 1967 and in 1968 (contract -change 
authorizations 726 and 1108) , and many assemblies already delivered to the LM con- 
tractor had to be returned to the vendor for reacceptance. Each assembly was 
also subjected to a preinstallation test at the contractor facility upon receipt from 
the vendor and before installation in a vehicle. This test was performed at ambient 
environmental conditions . Some of the more pertinent features of individual- 
assembly development are described in the following paragraphs. 
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Attitude and translation control assembly.- The ATCA was provided by 
a vendor under LM contractor purchase order ^P.O.) 2-24470-c. The ATCA is 

composed of four output subassemblies, three analog subassemblies, one power 
supply , one wiring subassembly , the assembly chassis and cover , electrical con- 
nectors, and one elapsed-time indicator. The complete assembly was specified 
to have a maximum weight of 12 kilograms (27 pounds) . The ATCA was mounted 
on cooling rails in the aft equipment bay of the LM ascent stage. 

The ATCA assembly-level developmental tests were performed on two units. 
Design-feasibility tests were performed on breadboard serial number (S/N) OOlS , 
and design-verification tests were performed on preproduction unit S/N 004, part 
number (P/N) LSC-300-140-5 . During design-verification testing, one failure 
occurred that required redesign . This failure consisted of a radiofrequency inter- 
ference at 120 megahertz and its harmonics. The problem was resolved by adding 
decoupling capacitors at the pulse-ratio modulator. One additional failure was 
resolved by changing the specification with regard to the distortion of the 800-hertz 
power-supply voltages that occurred at 150 hertz during audio -conducted suscepti- 
bility testing . 

Two production assemblies (P/N LSC-300-140-7 , S/N Oil and 013) were 
used in the qualification test program . Endurance qualification tests were performed 
on unit S/N 011, and design-limit tests were performed on unit S/N 013. The test 
requirements are contained in CTR LCQ-300-007, dated November 30, 1966, and 
revision A, dated August 24, 1967. 

No significant problems were encountered during qualification testing. 
However, a postqualification inspection of unit S/N Oil revealed the presence of 
cracks in some of the solder joints in the interconnection boards used to electrically 
and physically interconnect a number of cordwood modules. The modules contain 
copper bus wires that are soldered to the top of the interconnection board; the 
resulting space between the cordwood and the board is filled with urethane . The 
cracked joints were caused by mechanical stress resulting from temperature expan- 
sion of the urethane filler. The solution to this problem was to strengthen the 
joint by making it a reflowed convex joint. Because of schedule and cost considera- 
tions , a design change to provide stress relief was not made . Instead , all flight 
attitude and translation control assemblies were modified . 

An ATCA design change became necessary after the qualification had been 
completed. The change was made to eliminate a high-rate-limit-cycle (nonminimum 
impulse) condition for lightweight ascent conditions . The high-rate limit cycle 
was caused by marginal control-loop dynamics resulting from a slight change in 
the RCS thruster characteristics. The ATCA change consisted of altering the pulse- 
ratio modulator nonlinearity parameter from a value of 0.1 to 0.3. This change 
was qualified on ATCA unit S/N 013, after modification, to the requirements of 
CTR LCQ-300-029, dated July 10, 1968. The ATCA change was effective for LM-4 
and subsequent lunar modules. 
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Descent-engine control assembly .- The DECA was provided by a vendor 
under LM contractor P.O. 2-24486-c. The DECA contains approximately 1000 parts; 
95 percent of these parts are packaged as functional entities in 27 cordwood assem- 
blies , and the remaining parts are mounted directly to the chassis . Functionally , 
the DECA is made up of two trim-error subassemblies , two trim-error malfunction- 
detection subassemblies, one automatic-throttle subassembly, one manual-throttle 
subassembly , one power -switching subassembly , one elapsed-time indicator , two 
electrical connectors, and the chassis. However, these subassembly functions 
are not packaged as separate , replaceable , or interchangeable subassemblies . 

The complete assembly weight was specified to be no greater than 3.33 kilograms 
(7.35 pounds) , and the assembly was mounted on the LM descent stage. No cold- 
plate cooling was required. 

The DECA assembly-level developmental tests were performed on two units . 
Design-feasibility tests were performed on breadboard model S/N 001, and design- 
verification tests were performed on preproduction model S/N 004. No signifi- 
cant problems discovered in design- verification tests required redesign . 

Two production assemblies were used in the DECA qualification te.st program. 
Unit S/N 009 (P/N LSC-300-130-5) was used for endurance testing, and unit 
S/N 012 (P/N LSC-300-130-9) was used for design-limit testing. The part-number 
differences resulted from a design change made to the trim-fail circuits during 
the LM critical-design review before the beginning of qualification testing . In 
the S/N 009 configuration, an automatic trim shutdown was provided for use if 
the fail circuits detected a failure. In the S/N 012 configuration, a manual disable 
capability was provided instead of the automatic shutdown. All flight vehicles 
following LM-1 were equipped with a DECA having the manual disable capability. 
The qualification test requirements are stated in CTR LCQ-300-006, dated 
April 23, 1966. No problems encountered during qualification testing necessitated 
a design change . 

A delta-qualification test was performed on retrofitted DECA unit S/N 012 
after the previously mentioned DECA testing had been completed . The delta- 
qualification test was performed to qualify two DECA design changes that had been 
made because of a requirement for vibration of higher level than that specified 
by CTR LCQ-300-006. The two design changes were made as a result of problems 
encountered during vehicle-level tests on LM-1. One change was the addition 
of a coincident -pulse-detector circuit in the automatic -throttle counter circuit . 

This change was made to prevent complementing of the counter output caused by 
simultaneous receipt of thrust-increase and thrust-decrease pulses from the LGC . 
The other change was made to lower the 4.3-volt direct-current power-fail -monitor 
threshold. This change was made so that voltage drops in the vehicle cabling that 
supplies 4 . 3 volts to the DECA would not result in erroneous operation of the power- 
fail monitor. The vibration levels were increased as a result of LTA-3 tests, which 
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showed the DECA vibration levels to be higher than those used in the original 
qualification testing . The added qualification test requirements are defined in 
CTR LCQ-300-009, dated June 5, 1967. 

Rate gyro assembly .- The rate gyro assembly (RGA) was provided by a 
supplier under LM contractor P .O. 2-24465. The RGA consists of three subminiature 
rate gyros (located so that their sensitive axes form an orthogonal triad) , a support 
and insulator assembly, a component board and connect assembly, and an elapsed- 
time indicator . The gyro is a conventional aircraft -type rate gyro modified to accept 
800-hertz power for compatibility with the primary guidance power frequency . 

The maximum specified weight of the assembly was 0.9 kilogram (2 pounds) . 

The RGA developmental tests were performed on six assembly-level hardware 
items. Feasibility tests were performed on two of three units in addition to vibration 
testing of a mass model and materials and components testing. Design -verification 
tests and critical-environment tests were performed on four assemblies . No major 
design deficiencies were encountered during these tests . 

Two production assemblies subjected to qualification testing successfully 
fulfilled all requirements; no major problems were encountered . The test require- 
ments are defined in CTR LCQ-300-008, dated April 25, 1966. After test completion, 
vibration data from LTA-3 tests revealed higher vibration levels than those used 
in qualification. Revision A of CTR LCQ-300-008, dated May 25, 1967, reflects 
these increased levels. Revised vibration tests at these higher levels were per- 
formed successfully on one of the RGA qualification units . 

An RGA problem that occurred on the Apollo 10 mission (LM-4) apparently 
was caused by static friction (stiction) . The yaw rate gyro "hung up" for approxi- 
mately 40 seconds. Subsequent analysis indicated that contamination was the most 
likely cause of the problem and that subjection of the gyro to a questionable rework 
process during manufacture probably contributed to its contamination. Because 
the manufacture of all gyros had been completed , a stiction test was instituted to 
screen gyros with potential sticking problems. Another RGA problem, discovered 
during the LM-6 checkout at the NASA John F. Kennedy Space Center (KSC) , was 
evidenced by a lack of gyromotor synchronization. Although the LM-6 unit had 
operated properly during previous RGA acceptance and vehicle tests, an analysis 
of the unit revealed a deficient gyromotor hysteresis ring. A low -voltage-margin 
test was instituted to screen flight units for this deficiency. 

The low-voltage-margin test seems to be an effective screen for marginal 
motor characteristics . However , the stiction test is not believed to be effective 
in detecting all contaminated units . A stripdown and particle count performed 
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on three gyros revealed counts varying from approximately 400 to 1300 and sizes 
ranging from 0.025 to 0.889 millimeter (0.001 to 0.035 inch) . Previous stiction 
tests on these gyros indicated a slight stiction on two and no stiction on the third . 

Because the stiction screening test was not effective in detecting all contami- 
nated units, a plan was developed to reduce gyro contamination levels. This plan 
required that the gyros be returned to the vendor for rework . In rework , the 
gyros were disassembled and internal cavities and dead spaces sealed off to enhance 
gyro cleaning . The gyros then were flushed to specified contamination levels and 
refilled under white-room conditions with filtered fluid . The stiction screening 
test was continued following the cleaning rework. No further stiction problems 
were encountered either in screening or in flight . 

Attitude controller assembly .- The ACA was provided by a vendor under 
LM contractor P.O. 3-50010. The principal components of the ACA are three linear- 
output transducers, one three-axis rotational control mechanism, a housing and 
grip, two electrical connectors, and 43 switches. The specified maximum permissi- 
ble weight, including connectors and cables, was 2.15 kilograms (4.75 pounds) . 

Four attitude controller assemblies were used in the development-test program , 
which consisted of two phases . Phase I tests were performed on two preprototype 
assemblies fabricated in the model shop. The primary objective of Phase I testing 
was to obtain enough test data to establish an acceptable prototype design. The 
Phase II development tests were performed on a prototype controller; a second 
unit was available as a backup. The primary objective of these tests was to provide 
hardware-design verification in preparation for a complete mission simulation. 

The developmental testing did not reveal any major design problems. However, 
some test discrepancies required design or procedural changes (or both) . For 
example, one procedural change required that the switch packages be subjected 
to high temperature (339 K (150° F)) during ACA buildup to ensure correct switch 
overtravel adjustment . This particular change was not effective in ensuring correct 
overtravel adjustment because a high percentage of attitude controller assemblies 
exhibited improper switch adjustment when thermal -vacuum acceptance testing 
was later imposed as an acceptance requirement . This problem is discussed in 
the following paragraphs. 

Two production assemblies were subjected to the qualification tests, as 
required by CTR LCQ-300-001, revision B, dated November 22, 1966. Both units 
successfully completed testing without any significant discrepancies. A problem 
was encountered at low temperature (255 K (0° F)) with the pitch-axis torque hys- 
teresis, which was below the required 60-percent minimum value. It was deter- 
mined that at low temperature , the minimum hysteresis level in the pitch axis could 
be changed to 50 percent without serious effect on ACA use. Therefore, the require- 
ment was changed , and a hardware-design change was not necessary . 
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A sv^ritch-actuation problem discovered during LTA-8 thermal -vacuum tests 
at MSC was caused by improper switch adjustment, or turn-in, during ACA final 
assembly and calibration; improper adjustment prevented switch actuation under 
thermal or vacuum conditions (or both) . This problem was discovered just as 
the thermal-vacuum acceptance test requirements of contract-change authorization 
(CCA) 1108 were being imposed on ACA acceptance. Because the manufacture 
of all assemblies had been completed at the time of CCA 1108 implementation, it 
was necessary to return the controllers to the vendor for reacceptance . Many of 
the controllers examined contained improperly adjusted switches that did not actuate 
during thermal and thermal-vacuum conditions. This problem was resolved by 
reworking all flight attitude controller assemblies to newly developed switch- 
calibration procedures and by implementing more effective quality inspections. 

The recalibrated controllers were used on LM-3 and subsequent lunar modules . 

Much concern was evident in the program regarding the endurance of the 
ACA centering spring. This concern was stimulated by the switch-adjustment 
problem and by a spring failure at the NASA George C . Marshall Space Flight Center 
(MSFC) on one of the development-model assemblies (with uncontrolled usage) 
that had been provided to MSFC for laboratory use. The spring failed after an 
estimated 100 000 actuations. It was estimated that a flight ACA would undergo 
fewer than 1000 ground and flight actuations. However, because of the difficulty 
in predicting the actual number of actuations and the actual spring life , a redesigned 
spring was incorporated when the supply of the existing spares was exhausted 
in spring-life tests . The redesigned spring was installed only in an ACA that 
required rework at the vendor; other assemblies used springs of the original design. 

Thrust and translation controller assembly .- The TTCA was fabricated 
in-house by the LM contractor. The TTCA contains a position transducer for com- 
manding proportional throttle signals and 12 switches for providing three-axis 
translational signals to either the primary or the abort control system. A mode- 
selection lever is provided for selecting either the throttle or the jet mode. The 
maximum specified TTCA weight was 2.38 kilograms (5.25 pounds) . 

The TTCA developmental testing was performed on three controllers. Feasi- 
bility tests were performed on one controller , and verification tests were performed 
on two controllers. No major problems were encountered. 

Two production assemblies were subjected to the qualification tests required 
by CTR LCQ-300-003, revision A, dated November 9, 1966. A total of 13 failures 
occurred during qualification testing; one design change and two procedural changes 
resulted . The design change resulted from an excessive force spike (more than 
66.7 newtons (15 pounds) , compared with 31 newtons (7 pounds) as the maximum 
permissible) during X-axis cycling in the throttle-mode portion of the integration 
and checkout test. The high force occurred after 258 cycles; at that time, the soft- 
stop parts were replaced . After approximately 250 cycles , the high-force spike 
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occurred again , A failure analysis revealed that the high-force spikes had been 
caused by a wearing action on the chrome surface of a throttle linkage cam . The 
spike bungee and the cam were redesigned to reduce cam surface stresses . The 
redesigned model was subjected to 1500 cycles without degradation or visible wear. 
This problem has not reappeared on the redesigned units . 

A problem occurred during an operational check at ambient conditions when 
a switch in the endurance-test unit failed to actuate . Results of a subsequent failure 
analysis showed that the discrepant switch had a release force of zero . Other tests 
revealed that a maximum reduction of 0.56 newton (2 ounces) in release force could 
be expected after 2500 to 15 000 cycles. Before this occurrence, the minimum 
acceptable switch-release force had been specified as 0.56 newton (2 ounces) . 

This problem was resolved by increasing the minimum switch-release force to 
1.11 newtons (4 ounces) . Another switch-actuation problem was that the switch 
turn-in was insufficient to accommodate thermal -vacuum conditions . The existing 
requirement for a turn-in of 30° was not adequate for all environmental conditions 
and was increased to 45°. The additional turn-in resolved this problem. A toler- 
ance study for the 45° switch adjustment was conducted by the LM contractor . 

Gimbal drive actuator .- The gimbal drive actuator (GDA) was provided 
by a vendor under LM contractor P .0 . 2-24478. 

As an integral part of the development -test program, the GDA was subjected 
to a reliability-assurance (stress to failure) test in which the GDA was tested to 
failure under systematically increasing dynamic and environmental stresses . 

A failure was described as a deviation of performance from the minimum acceptable 
operating mode. The failure-mode-prediction analysis provided the basis for selec- 
ting critical stresses that were used in the stress -to-failure tests. 

A qualification test performed on the GDA prototype model demonstrated 
that the prototype design satisfied the requirements under environmental conditions 
imposed in the order of occurrence of the applicable environment during a mission . 
An acceptance test was performed on each assembly to demonstrate that the assembly 
satisfied all the requirements of the applicable specification and that it conformed 
to the applicable approved design . 

After the qualification test, the GDA was subjected to a reacceptance vibration 
test (CCA 726) and a thermal-vacuum test (CCA 1108) . Operational failure of one 
unit during thermal-vacuum testing was attributed to low temperature , not to vac- 
uum . Just before that failure , a GDA failure under ambient pressure and temperature 
at the LM contractor facility was caused by a reduced airgap between the motor- 
brake polarizer and the brake armature. As a result of testing (CCA 1108) , it 
was determined that many of the units deviated from the performance requirements. 
The malfunction of the actuator was attributed principally to the motor. The predom- 
inant malfunction was coasting of units caused by failure of the brake to engage 
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in the alternating-current motor. The failure rate was approximately 50 percent 
on coast; however , one unit drew excess power . Although coasting of the actuator 
did not constitute a problem within the actuator , prolonged coasting caused the 
DECA to indicate a descent-engine trim failure . 

The analyses of the Apollo 9 and Apollo 10 missions for a nominal and a faulty 
GDA brake showed negligible effects. Therefore, it was concluded that a GDA 
brake failure would not preclude the completion of these missions . However , the 
acceptability of a false caution-and-warning GDA failure indication resulting from 
a GDA brake failure was still a matter for consideration . 

The vendor was directed to modify the GDA . The redesign affected only 
the motor area and embodied a constant-drag principle . The redesigned actuator 
was subjected to a delta-qualification test and an extended -life test . When these 
tests had been successfully completed , it was determined that the new design would 
be flown on Apollo 11 and subsequent missions. 

After the new actuators had been installed in LM-5 (Apollo 11) , a failure 
occurred - the actuator did not respond to a start command. The failure resulted 
from a phase-angle difference between the power circuit of the DECA and the GDA 
motor. A capacitor assembly was added at the DECA/GDA interface to improve 
the phase-angle relationship . 

A review of the design-verification test , the qualification test , the vehicle 
test , and the mission data supports the fact that the GDA fulfilled all design require- 
ments . The gimbal drive actuators performed all required functions throughout 
the Apollo 9,10, and 11 missions . The caution- and -W8irning light indicating gimbal- 
trim malfunction was observed on the Apollo 10 mission. The actuation of this 
caution-and-warning signal was attributed to brake coasting because the GDA per- 
formed normally during subsequent use on the Apollo 10 mission . 


Subsystem Verification Tests 

Because the subsystem has been procured at the black-box or assembly level, 
none of the subsystem-level verification work was done by the equipment vendors . 
All subsystem -level testing was accomplished in vehicles and in the LM contractor 
Full Mission Engineering Simulator /Flight Control Integration (FMES/FCI) 

Laboratory . 

Full Mission Engineering Simulator /Flight Control Integration Laboratory . - 
The FMES/FCI Laboratory was used to perform preinstallation tests on all flight 
equipment before it was installed in a vehicle . These tests were performed at ambient 
environmental conditions at the assembly level only. The FMES/FCI Laboratory 


14 


was used earlier in the Apollo Program for developing preinstallation test procedures 
and for performing assembly -integration tests. The integration tests, which included 
the first electrical interfacing of individual assemblies , were performed on early 
breadboard or preproduction equipment to verify interface compatibility and to 
help establish subsystem-level test tolerances . No major problems were encountered 
during these tests . 

Closed-loop simulation tests were also performed to verify system dynamic 
characteristics and to supplement analytical evaluations . The previously noted 
ATCA change (associated with the high-rate limit cycle) was evaluated in a closed- 
loop simulation and supported an associated analytical assessment • 

The LTA-1 vehicle tests .- The LTA-1 vehicle was used for early systems- 
level testing. In general, the subsystem hardware used was of a preproduction 
configuration . The testing was discontinued at an early date; no significant hard- 
ware or interface problems were discovered during the limited test activities . 

The tests were useful in developing the vehicle operational checkout procedures . 

The LTA-8 thermal-vacuum tests . - The LTA-8 thermal-vacuum tests were 
performed in the thermal-vacuum facility at MSC . The only problem encountered 
in the stabilization and control system was associated with the ACA switch-actuation 
deficiency . This problem was resolved as noted in the subsection entitled "Attitude 
controller assembly . " 

The LM-2 drop test .- The LM-2 drop-test program was conducted at MSC 
to evaluate subsystem integrity after vehicle drops representing worst-case lunar- 
touchdown conditions . Individual assemblies had been designed to survive landing 
shocks safely , and this capability had been demonstrated during the assembly- 
level qualification testing . However , cabling integrity had not been demonstrated , 
and these tests served to verify that no problems existed in this area of vehicle 
design . 


MISSION EXPERIENCE 


All detailed test objectives had been satisfactorily accomplished before the 
Apollo 11 (LM-5) mission. These objectives, pertaining in whole or in part to 
the SCS, are given in table 1. The problems that occurred during each mission 
are described in the following paragraphs . 


The LM-1 Mission 


The LM-1 mission was unmanned and was flown without an operating AGS . 
Descent-engine burns , ascent-engine burns , and fire-in-the-hole staging were 
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TABLE I.- DETAILED TEST OBJECTIVES 


Number 

Objective 

Description 

Pll.l 

Descent propulsion system 
(DPS) gimbal actuators 

Verify descent-engine gimbal- 
ing response to control 

P12.3 

AGS /control electronics sec- 
tion (CES) atttitude/ 
translational control 

Demonstrate RCS translational 
and attitude control of 
unstaged LM using automatic 
and manual AGS/CES control 

P12.4 

AGS delta-velocity capa- 
bility using DPS 

1 

Perform an AGS /CES -controlled 
DPS burn with a heavy 
descent stage 

S12.8 

AGS /CES attitude/translational 
control 

Demonstrate RCS translational 
and attitude control of the 
staged LM using automatic 
and manual AGS/CES control 

S12.9 

Unmanned AGS -controlled 
ascent propulsion system 
(APS) burn 

Perform an unmanned AGS- 
controlled APS burn 
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accomplished by using the SCS in conjunction with the LM mission programer . 
Attitude control was accomplished with only the rate-stabilization loop because 
the AGS normally provides the attitude reference . The main-propulsion burns 
and staging were performed with the SCS because of an LGC software/propulsion 
interface incompatibility. 


The LM-3 Mission 

The LM-3 mission (the first manned LM mission and an Earth-orbital mission) 
was accomplished with only one SCS discrepancy: a failure indication in the descent 
trim system . This indication was not an unexpected flight occurrence because 
the GDA coasting problem , which produces such an erroneous indication , had been 
experienced with LM-3 during checkout at KSC . (See subsection entitled "Gimbal 
drive actuator.”) An evaluation of this problem in terms of mission effects had 
been made before the mission, and a decision was made not to replace the actuators 
with units having the coasting modification . Therefore , all concerned personnel 
were prepared for this occurrence , and no detrimental mission effects resulted . 


The LM-4 Mission 

The rate gyro "hangup" problem (previously noted in the subsection entitled 
"Rate gyro assembly") occurred in lunar orbit of the LM-4 mission during descent 
staging. The total time of abnormal operation was approximately 40 seconds. 

This problem was identified during data analysis after the mission . Except for 
this discrepancy, the subsystem performed normally. 


The LM-5 Mission 

The first lunar landing mission (LM-5) was accomplished without any known 
subsystem discrepancy or problem . 


CONCLUDING REMARKS 


Special care should be devoted to mechanical stresses that a given packag- 
ing design may place on solder joints . The solder-crack problems experienced 
on the attitude and translation control assembly , on other lunar module subsystems , 
and at the NASA George C . Marshall Space Flight Center indicate the need for such 
design' care before a production commitment is made . 
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Because the mechanical calibration of some equipment may be affected by 
environmental factors, such equipment should be verified for acceptance by appro- 
priate environmental tests . The problems experienced with attitude controller 
assembly switch calibration attest to the value of such tests . 

The gyro contamination problem and its resolution indicate the need for special 
care in the design and fabrication of devices that are sensitive to contamination . 

In a zero-g environment, there is perhaps a greater tendency for contaminants 
to migrate from entrapped areas than would be the case in a one-g environment . 
Hence , special attention should be devoted to the elimination of features that may 
act as contaminant collection points and subsequent migration sources during 
zero-g operation . 

It is believed that subsystem integration can best be achieved if a single 
vendor supplies the hardware to sub system -lev el requirements. This approach 
contrasts with the lunar module stabilization and control subsystem procurement , 
which was at the assembly level with the lunar module contractor retaining integra- 
tion responsibility . The impedance-mismatch problem between the gimbal drive 
actuator and the descent-engine control assembly resulted from a minor gimbal 
drive actuator change made without sufficient understanding of the interface effects . 
Although subsystem -level procurement is not a panacea for all problems, its appli- 
cation would make this sort of interface problem much easier to avoid than with 
assembly-level procurement . 


Lyndon B . Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, November 8, 1974 
914-50-00-00-72 
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